[] UNCLASSIFIED — ApATONYERNAE Release 2004/05/12 £]A-OMEADENT AGR000 1000600 1558 RET 


: ROUTING AND RECORD SHEET ‘ 


SUBJECT: (Optional) 


APEX Industrial Security Manual 


; EXTENSION | NO. 
| [| DATE 


21 March 1979 


TO: (Officer designation, ber, and 
Building) pis ictal Cacia aie OFFICER'S | COMMENTS (Number each comment to show from whom 


INITIALS to whom. Draw a line across column after each comment.) 
RECEIVED FORWARDED 
1. 


4E70 HDQS 22 Tova |X2 AL, yr 


2. 
3. o 1 | 


6 
7 | 
| 
8. 
9 
oa 
10. 


13. 


om 610 “Est ] SECRET [] CONFIDENTIAL [7] INTERNAL = 7) UNCLASSIFIED 


i Approved For Release 200H05HM 2 + CLA-RDP85700788R000100060015-2 


= 

= : Parc | 
oa a oy 
- 


21 March 1979 


MEMORANDUM FOR: Deputy Director of Security (PSI) 
Chief, Security Staff, OD§E 
Chief, Security Staff, OL 
Chief, Technical Security Division, OS 
Chief, Information Review Group, OS 
Chief, Special Security Center, 0S 
Chief, Information Systems Security Group, 0S 
Associate General Counsel, OL 
Chief, Policy and Plans Group, OS 
Chief, Communications Security Staff, OC 
Chief, Industrial Security Branch, OS 


25X1 FROM: See 
Member, Industrial Security 


Manual Working Group[__]| 25 


SUBJECT: APEX Industrial Security Manual[ _| 25 


1, Attached for your review and comment is a draft 
industrial security manual prepared by the Community Security 
Group, DCI Security Committee, which describes the proposed 
Special Access Program system, known as APEX, and which 
provides "standard procedures and guidance" to contractors 
for the control and protection of Sensitive Compartmented 
Information (SCI). The industrial security manual represents 
the follow up to an APEX Control System Manual governing the 
control of SCI within government.[ _] 25 


2. Addressees will probably note that the attached 
draft lacks the procedural details spelled out in the recently 
coordinated "Standard Security Procedures for Contractors" 
governing Agency collateral classified contracting activities 
and that in many areas the two manuals lack uniformity. You 
may want to bear this in_mind during your review, and comment 
25X1 as you deem appropriate. 


3. In addition to a substantive review, you are 
requested to consider whether or not the manual should be 
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classified (and if so, at what level). You will note 
that for the present time the current draft is classified 
CONFIDENTIAL. Please explain your rationale in either 
case. 


4. Please submit your responses to me by the close of 
business 30 March 1979. All responses will be reviewed, 
consolidated and presented as the Agency position before the 


Manual Preparation Working Group. Should you have questions, 


Attachment 
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I. INTRODUCTION 


- This Manual describes the Special Access Program system 
known as APEX, which is herewith established under authority 
of the National Security Act of 1947, Executive Order 12036, 
and Executive Order 12065 to provide standard procedures and 
guidance to Gontractors on the control and protection of 
Seneieie: Conparinenccd in rorneteon (SCI) defined as aneStelS 


Access Programs within the category of national Security 


information called National Foreign Intelligence. 
This Manual will serve as the authoritative guide for 


the security and control of Sensitive Compartmented Information 


' This Manual is not, however, intended to intrude on the authorit 


of government Program Managers, who will continue to prescrike 
basic operational direction, classification guidance and policy 
on disceninueion for programs under their cognizance. 

The term APEX, APEX Security Control System, its project 
codewords and product categories are all unclassified when 
Standing alone or not connected to their intelligence activitie 
or intelligence information. However, by nature of individual 
contracts, the connection of a contractor to APEX activity may 


require that such Connection be treated as “association 


classified", 
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II. ORGANIZATIONAL STRUCTURE 
ORGANIZATIONAL STRUCTURE 


Senior Intelligence Officers (SIO's) of the U.S. Govern- 
ment Departments and Agencies represented on the National 
Foreign Intelligence Board (NFIB), Directors of designated . 
sensitive collection programs, Government Contracting Officers 
and industrial contractors engaged in Special Access Programs 
are responsible for enforcing the policy and implementing the 


ss 
> 


procedures outlined in this Manual. 


Shap 
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To fulfill their responsibilities government officials © 
may praviae additional implementing sutdance to contractors 
under hes conn i genes as necessary,as long as such guidance 
is in consonance with this Manual. 

| Although the above-named government and industrial officia 
must have the Overall responsibility for policy compliance and 
impglementation of pertinent procedures, adherence to the 
Security and control procedures outlined in this Manual is alsd 


the personal responsibility of each person indoctrinated into 


the APEX Security Control System. 
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To assist in carrying out the precepts dictated by the 
APEX Security Control System, the designated responsible 
officials will appoint or cause to be appointed APEX Control 
Officers (ACO's), and APEX Security Officers (ASO's)}, with 
alternates, to administer the system within contracting firms. 
ACO's and ASO's shall be appointed within each firm at whatever 
levels may be appropriate. Their responsibility is to actively 
administer the APEX System within their firms and to ensure 


full compliance with the provisions of this Manual and any _ 


“4 


subsequent supplemental APEX directives as may be issued. es 
It is preferable that the ACO and ASO positions not be 
held by the Same individual unless management, Operational and 
organizational considerations clearly dictate otherwise. In 
that case, the ACO may also be appointed to serve as the ASO. 
SIO's and Program Managers/Directors are responsible for 
the establishment of APEX Control Facilities (ACF's) within 
industry for the control, Storage and use of APEX materials. 
These facilities will be centralized or decentralized within 
industrial firms depending on joint Security-management 


concerns. 
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All APEX information will be transmitted and maintained 
within the APEX Security Control System. Gonparoneneaelon: 
within the system will be denoted by the use of terms iaentae 
fying categories or product information and by project words 


which refer to collection activities. 
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III. DESCRIPTION OF SYSTEM. 
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a. General: The APEX Security Control System provides 
a single system for controlling access to selected intelli- 
gence information and Programs requiring extra amounts of. 
protection. Within this unified system there are distinct: 
means of controlling access to operational data, as well as 
access to the product of generic sources: of intelligence ser 
formution and finished product by the establishment of discipli 
balanced threshold criteria that allow only sensitive data ie 
be placed inside compartmented access control. ; 
b. Access to APEX Security Control System: Three steps 
are necessary for access to the APEX Security Control Systen: 
1. Certification by the SIO, or Govern- 
ment Project Manager or contracting officer of 
‘needftofknow $e specific aspects of the APEX 
Security Control System (operational projects, 
operational subcompartments, generic products). 
In the case of access to operational | 
projects, nominees need-to-know will be jointly 
certified by the SIO and the individual Agency's 


Program Manager/Director. 
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2. Favorable adjudication that the 

nominee meets uniform personnel security 

criteria and investigative requirements set 

forth in this Manual. 

| 3. Security Indoctrination and execution 

of a Non-Disclosure Agreement as a condition of 

access to APEX material. 

The security indoctrination will provide the individual 
wath sufficient Specific information so that he will know what 
he is to protect, his responsibilities in doing so, and general 
information about the APEX Security Control System so that he’ 
Will know how the system is to be used in carrying out this 
responsibility. If additional access approvals are required 
the processing steps enumerated above will be repeated. 

“Upon indoctrination for any access to APEX material, the 
individual's name and all approvals held will be recorded in 
the Central Access Approval Registry. 

Cc. Revalidation of Access: In January of asch year, SIo! 
and Program Managers/Directors in both Government and industry, 
will review all extant approvals under, their cognizance ana rev 
date all required accesses. Those no longer required Will be 


formally terminated. 


6 


ase ee 
Approved For Release 2004/05/12 :, CIA-RDP85T00788R000100060015-2 


Guise eee AL 
Approved For Release 2004/05/12 : CIA-RDP85T00788R000100060015-2 


In addition to this formal, annual review progran, 

it is the responsibility of each of the above responsible offic 
to maintain a continuous review of access approvals to ensure 
that only those personnel with documented "necd-to-know" have 
access at any time. 3 | 

d. Termination of Access: When it has been determined 
‘by the appropriate responsible official that individual accesse$ 
are no longer Redusreds the individual ‘concerned will be notifi 
chat eye access to specific types of information is no fone 


justified and that access privileges are being terminated. “the 


(Cots ihe 


cognizant government Agency will be notified of all termina Soh 

and, in turn, will notify the Central Access Approval Registry. 
Personnel may, within need-to-know requirements, be 

authorized to transtey internally within their industrial firms 

and retain required access approvals, ‘However, when: leaving 

one firm to join another, all approvals will automatically 

be cancelled and need-to-know established by the new employer. 

Following approval by the cognizant Agency, those accesses 

deemed necessary for the completion of une lacs With 

the new employer will be granted ez reinstated but a new 


secrecy agreement will be required. 
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Qe. Termination Secrecy he eeaneness At the time access 
is no longer required, the individual will be required to accou 
for and surrender all APEX documents under his cognizance and 
control, execute a certification that he retains no material or 
documents in the “APEX system, and be reminded of the continuing 
obligation not to discuss or otherwise reveal APEX-controlled 
information. | 

sa Meeeee Ceilings: In order to control access to infor- 
mation within the APEX Security Control eyeten: STO's and ee 


Government Program Managers will provide access: ceilings for.” 


each contract activity involving APEX material. 
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IV. RESPONSIBILITIES OF APEX CONTROL AND SECURITY OFFICERS 
etn ee ELE UE 


a. Duties of APEX Control Officers: 

1. With the appropriately cleared officials, 
ensure that APEX materials are accounted for, con- 
trolled, transmitted, destroyed, packaged and other- 
Wise safeguarded in accordance with provisions of . 
this Manual, 

Z. Act as the exclusive control point within 
an APEX Control Facility for receiving and dis- 
patching APEX materials via electrical, courier 
Or other means approved for ‘the transmission of 
APEX materials. 

3. Complete and return to the sender receipts 
attached to APEX documents received. Ensure that. 

' all.outgoing materials have properly prepared 
receipts and send tracers as required for 
receipts not returned. . 

4. Ensure that APEX materials are ais ceminaeen 

Only to ‘those persons properly indoctrinated and 


with a valid need- to- know. 
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S. Provide advice and guidance on the proper 


classification levels, codewords and caveats within 


the APEX Security Control System. 


6. Work closely with the APEX Security Officer 


to maintain the integrity of the APEX Security 
Control System. | 
b. Duties of APEX Security Officers: | 

1. Coordinate and receive prior approval 
through appropriate channels, as reflected in 


VII.b for accreditation and establishment of APEX 


Control Facilities. 


2. Maintain current listings of all APEX- 
accessed individual‘ within his jurisdiction. 
3. Process all APEX access approval requests 


for personnel within his jurisdiction. 


4. Conduct required security indoctrinations 
and dobre rine: of personnel approved for APEX 
access and obtain signed Non-Disclosure and Ter- 
mination Secrecy Agreements as secescay: 

5. Conduct reindoctrinations on a periodic . 


basis, not to exceed two year intervals. 
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6. Conduct annual security inspections of 
APEX Control Centers under his jurisdiction and 
submit a copy, with any recommendations for 
corrective action, to the accrediting official. 
COneuee follow-up action on recommended corrective 
measures, | 

a Establish security procedures for trans- 
mitting and receiving APEX materials. 

8. Conduct investigations of any possible 
Security infractions involving APEX information 
under his jurisdiction to determine if a compromise 
has occurred, make appropriate recommendations, and 
prepare required reports. 

‘9. Notify cognizant agencies of all additions 


and deletions of access approvals within the APEX 


System on a timely basis. 
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V. SECURITY STANDARDS FOR ACCESS APPROVAL 


"a. Need-To-Know Policy: Access to the APEX Security 


Control System is governed by the "need-to-know' policy in 
conjunction with approval criteria established in this Manual. 
’ The need-to-know policy is defined as that determination made 
by competent au enox tty. which attests to the bona fide need - 
for access to perform official duties on behalf of the United 
States Government. Need-to-know will be strictly applied and.. 
access will not be given solely by virtue of rank or status® | 
Within an industrial firm. Need-to-know approval rests with 
responsible. government officials. 
| b. Personnel Security Standards: Criteria for security 
approval of an individual on a need-to-know basis for access t¢ 
the APEX Security Control System are as follows 
- 1. The individual shall be stable, of excellent 
character and discretion and of unquestioned loyalty: 
to the United States. 
2. Except where there is a compelling need and 

a determination has been made by competent authority 

as described below that every reasonable geeweanes 

has been obtained that under the circumstances the 

security risk is negligible: | 

(a) Both the individual and the 


members of his or her immediate fa maly 


its. Peas 
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shall be U.S. citizens. For these pur- 


poses "immediate family" is defined as 
including the individual's spouse, parents, 
‘brothers, Sisters and children. 

(b) “The members: of the individual's 
immediate family and persons to whom he 
is bound by affection or obligation should 
neither be subject to physical, mental 
‘or other forms of duress by a foreign 


a an 
power, nor advocate the use of force of 


violence to overthrow the Government of the 
United States by unconstitutional means. 

In exceptional cases, a responsible government official 
may determine that it is necessary or advisable in the national 
interest to authorize access to APEX prior to completion of the 
fully picketed investigation. In this Situation, such 
investigative checks as are immediately possible shall be | 
made at once, and should include a personal interview by Phepne 
security or counterintelligence personnel. Access in such case 
Shall be strictly controlled, and the fully prescribed investi- 
gation and final evaluation shall be completed at the earliest 
practicable moment. 

Exceptions to 2(a)(b) above may be granted only by a 
government SIO or his designee. All exceptions granted will be 
common sense determinations based on all available information 


and shall be recorded by the agency making the exception. In 
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SBP ye es in Which the ind ae. mas lived outside of the 


United Sravee for a substantial period of his life, a thorough 
assessment of the adequacy of the investigation in terms of 
fulfillment of Pie ani adn investigative requirements and 
judicious review of the: inforiation therein must be made 
before an exception is considered. 

c. Investigative Requirements : The investigation con- 
ducted on an individual under consideration for access to the 
APEX Security Control System will Be thorough and. shall be 


designed to develop information as to whether the individual - 


clearly meets the above Personnel Scurry Standards, 


ytd je 


The investigation shall be accomplished through recoré 
checks anda personal interviews of various sources by trained 
investigative personnel in order to establish affirmatively to 
. the adjudicating agency complete continuity of identity to 
include birth, seetGche és: education, employments and military 
SCruace: Where the circumstances of a case indicate, the 
investigation shall exceed the basic requirements set out below 
to ensure that those responsible for adjudicating access _ 
eligibility have in their possession all the relevant facts 


available. 
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The individual shall furnish a signed personal history 
statement, fingerprints of a quality acceptable to the Federal 
Bureau of Investigation ane a signed release, as necessary, 
authorizing custodians of police, credit, education and medical 
neeueas: to provide record information to the investigative 
agency. Photographs of the ee ore shall also be obtained 
where additional corroboration of identity is required. 

Minimum standards for the investigation are as 
follows: 


‘1. Verification of date and place of birth 


and citizenship. 

2. Check of the subversive and criminal files 
of the Federal Bureau of Investigation, including | 
submission of fingerprint charts, and such other. 
National agencies aS are appropriate to the individual's 
background. An additional check of Immigration and | 
‘Naturalization Service records shall be conducted on 
those members of the individual's immediate family 
who are United States citizens other than by birth 
or who are resident aliens. ; 

3. A check of appropriate waviee (eeoKds covering 
all arcas where the individual has resided in the U.S. 
throughout the most recent fifteen (15) years or since 


the age of eighteen, whichever is the shorter period. 
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4. Verification of the individual's £ingnerat 


status and credit habits through checks of appropriate 
credit institutions and interviews with knowledgeable 
sources covering the most recent five (5) years. 

| 9. Interviews with neighbors in the vicinity of 
all the individual's residences in excess of Six (6) 
months throughout the most recent five (5). year period. 
This coverage shall be expanded phere the investigation 
Suggests the existence of some questionable behavioral 


pattern. . ee 


6. Confirmation of all employment during the past 
fifteen (15) years or since age eighteen, whichever 
is the shorter period but in any event the most recent 
two years. Personal interviews with supervisors and 
co-workers at ple.ces of employment covering the past 
ten (10) years shall be accomplished. | 

7. Verification of attendance at institutes of | 
higher learning in all instances and at the last 
secondary school attended within the past fifteen (15) 
years. Attendance at secondary schools may’ be verified 


through qualified conlater set sources. If attendance at 
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educational institutions occurred within the most 
recent five (5) years, personal interviews with the 
faculty members or other persons who were acquainted | 
with the individual during his attendance shall be 
accomplished. 

8. Review of appropriate military records. 

9. Interviews with. a sufficient number of 
knowledgeable acquaintances (a minimum of three 
developed during the course of the investigation) as 


oom 


necessary to provide a continuity. to the extent practicab 
of the individual's activities and behavioral weed 
over the past fifteen years with particular emphasis a 

the most recent five years. 

10. When employment, education or residence has 
Occurred overseas (except for périod of less than five 
(5) years for personnel on US Government assignment 

’and less than ninety days for other purposes) curing? 
the past fifteen years or since age eighteen, a check 
of the recerds will be made at the Department of State 
and other appropriate agencies. Efforts shall be made 
to develop sources, generally in the United ‘States, who 
knew the individual overseas in order to cover 
significant employment, education or residence 


and to attempt to determine if any lasting foreign 
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contacts or connections were established during 
this period. However, in all cases where an 
individual has worked or lived outside of the 

in U.S. continuously for over five years, the 
a viestiewbron wag be expanded to cover fully 
this period in his life chreush-the use of such 
investigative assets and checks of record sources 
as may be available to the US Government in the 
foreign country (ies) in which the individual 


resided, 


11. In those instances in which the individual 
has immediate family members or other persons with 
whom he is bound by affection or obligation in any 
of the creantione described in subparagraph c2.{b) 
above, the investigation will include an interview 
of the individual by trained ree investigative 
or counterintelligence personnel to ascertain the 
facts as they may relate to the individual's access 
eligibility. 

12. In all cases, the individual's spouse shall, 
at a minimum, be checked through the subversive files 
of the Federal Bureau of Investigation and other 


.National agencies as appropriate. When conditions 
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indicate, additional investigation shall be 


conducted on the spouse of the individual ang 
members of the immediate family to the extent necessary 
to: Hevindt a determination by the adjudicating 
agency that the provisions of Personnel Security 
Standards, above,are met. 
13. A personal interview of the individual 
will be conducted by trained security, investigative 
Or counterintelligence personnel when necessary to 


resolve any significant adverse informetion and/or 


inconsistencies developed during the investigation. 
Where a previous investigation has been conducted 

Within the past five years which substantially meets the above 
minimum Standards, it may serve as ee for granting access 
approvals provided a review of the personnel ane security files 
does not reveal substantive changes in the individual's securit 
eligibility. If a previous investigation does not substantiall 
meet the minimum standards or if it is more than five years old 
‘a current investigation shall be required but may be limited 
to that necessary to bring the individual’ Ss file up- to-date 
in accordance with the investigative requirements set forth 


above. Should new information be developed during the current 


investigation which bears unfavorably upon the individual's 
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activitics covered by the previous investigation, the curre 


inquirics shall be expanded as necessary to develop full 
details of this new information. 

The evaluation of the information developed by 
investigation on an individual's loyalty and suitability sh 
be accomplished under the cognizance of the SIO concerned b 
analysts of broad knowledge, good judgment and wide experie 
in personnel security and/or counterintelligence. 

When all other information developed on an individu 
is favorable, a minor investigative requirement which has : 
been met should not preclude favorable adjudication. ta at 

evaluations, the protection of the national interest is pari 
mount. Any doubt concerning personnel having access to APE} 
information shall be resolved in favor of the national secun 
ihe Wie tate determination of whether the granting of access 
is clearly consistent with the interests of national securit 
shall be an overall common sense determination based on all 
available information. 

d. Reinvestigations: Programs shall be instituted requ 
the periodic reinvestigation of personnel provided access to 
APEX information. These reinvestigations will be conducted 
on a normal five year recurrent basis, but on a more frequen 
basis where the individual hes shown some questionable behay 
pattern, his activitics are otherwise suspect, or when deeme: 


necessary by the SIO concerned. 
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The scope of reinvestigations shall be determine? 


by the SIO concerned based on such considerations as the 
potential damage that might result from the individual's 
defection or willful compromise of APEX information and the 
availability and probable effectiveness of other means to 
continually evaluate factors related to the individual's 


suitability for continued access. -In all cases, the reinvesti 


gation shall include, as a minimum, appropriate National agenc 


checks, local agency, (including overseas checks where appropri 
credit checks and a personal discussion with the individual” = 
by truined investigative, security or counterintelligence . 
personnel when necessary to resolve significant adverse infor- 
mation or inconsistencies. 

# Whenever adverse or derogatory information is dis- 
covered or inconsistencies arise which could impact upon an 
individual's security status, appropriate investigations shall 
be conducted on a timely basis. The investigation shall be of 
sufficient scope necessary to resolve the specific adverse 
or derogatory information, or inconsistency, in question SO 
that a determination can be made as to whether the individual' 
continued utilization in activities requiring APEX is clearly 


consistent with the interests of the national security. 
ay 
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C. Contacts or Assoociation with Foreign Nationals 
and Alicn Marriages: Close, continuing personal associations 
wat? foreign nationals ements of APEX Security concern if 
they become characterized by ties of kinship, affection or 
eitiedeién. | APEX~cleared personnel must protect themselves 
against cultivation and possible exploitation by foreign 
nationals who are or may be working for foreign intelligence 
services and to whom they might even unwittingly provide APEX 


‘Classified information. The following types of relationships 


must be reported to the APEX Security Officer. 
| 1. All contacts with ea einene or representatives. 
of communist-controlled countries, no matter how brief 
or apparently trivial the ‘contacts may be. 
; 2. Close and continuing Or any regular, frequent 
contact with any other foreign national. | 
Casual, inadvertent, or irregular eontaees which aries ech 
normal living and working in a community need not be reported. 
However, if the person with whom the casual contact occurs 
shows undue interest in employment, assignment, etc., then the 
contact must be promptly reported. Whenever any doubt exists 
whether a situation should be reported or made a matter of 
record, the individual should promptly make a report to the 
APT:X Secitrity Officer. Failure to report such contact may 


result in denial or withdrawal of access to APEY material. 
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APEX approved individuals who contemplate marriage to 

a non-U.S. citizen must report such plans to their APEX 
“Security Officer along with, at a minimum, details about 
the intended spouse's name, date and place of birth, country 
of origin and current citizenship, identity of immediate 
family members, current residence, present occupation and 
any present or former employment on behalf of any foreign 
government. Investigation of the prospective spouse Will be 


undertaken prior to a determination being made that a waiver. 


of standards might be made to continue the approved person 
in cleared status. 
fy ‘Speer Restrictions: 

1. -Unofficial Travel: Persons granted authoriza- 
tion for access to cevbain-catereries of extremely 
sensitive information on foreign intelligence sources 
and methods protected by the APEX Security Control 
System incur a special security obligation and are 
to be alerted by their APEX Security Officer to 
risks associated with unofficial visits to, or 
travel through certain destaneeed countries. The 
APEX Security Officer concerned should advise that 


unofficial travel in those countries without official 
a 
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approval ‘may result in he withdrawal of approyal 
for continued access to APEX information for 
persons with specific and extensive knowledge of 
the following categories of extremely sensitive 
information on foreign intelligence sources and 
methods: | 
(a) Technological structure, function 
and technique of sensitive intelligence 
collection or exploitation systems/methods. 
(b) Designated system targets or re 
sources. , 
(c) Method and purpose of target 
selection. | 
_ . (d) Degree of success of collection 
or exploitation system/method 
(e) Collection or exploitation 
system/method capabilities and vulnera- 
bilities. 
All persons having access to APEX apeormanton who plan 
unofficial travel to or through eestgnaccd countries must: 
(a) Give advance notice of such planned 


travel. 
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(b) Ghent a delensive security 
briefing from an APEX Security Officer 
before traveling to such countries. 
(c} Contact immediately the nearest 
' U.S. consular, attache, or Embassy sfficsei 
if they are detained or subjected to signifi- 
cant harassment or provocation while traveling. 
(d) Report nen return from travel to. 
their APEX Security Officer ang incidents of 


potential security concern which befell them. 


tees 
Sie 


2. Individuals with Previous Access: Persons whose’ =" 
access to APEX information is being terminated WiLk be - 
officially reminded of the risks associated with hazardous 
activities as defined herein and of their obligation to 


énsure protection of APEX. 


Gord ATHAL 
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VI. FACTORS GOVERNING CONTRACTOR ACCESS 


‘a. General Guidelines: . Contractors and consultants 
dealing with participating Government Agencies or Departments 
will be furnished only that information whith is essential 
to the fulfillment of contractufal obligations. “This Manual 
will serve as the operating aivveebive fox the conduct of . 
APEX activities within industry. 
b. Factors Considered in Selection of Contractor Firms: 
A contractor or consultant's past record in properly sat oovardind 
material will be taken into account when making contractor 
selections for work on APEX“related activities. In this regard, 
when an APEX facility is established in industry, the APEX 
Security Officer of the government component responsible for 
its security will closely monitor its activities to ensure that 
APEX procedures are followed completely and that APEX materials 
are properly segregated from any other classified or unclassified 
natervats of the contractor. 
c. Restrictions on Access: Contractor Suaanies which 
are under foreign ownership, control or influence shall 


generally be ineligible for access to APEX activities and 
a 
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information. However, if that ownership, control or influence 
is not from a Communist-controlled country and the foreign 
interests own less than five percent of the contractor's voting 
Stock and such minority. holdings do not enable the foreign 
interest to control the appointment and tenure of the con- 
tractor's APEX-approved managing officials, a waiver of this 

- provision may be granted after cognizant Agency review. Prior 
to the granting of a waiver, provisions must be made to ensure 
that security safeguards exist to prevent disclosure of APEX- 


i 


controlled information to any non-U.S. owners and managing 32 * 


officials. -Should foreign ownership increase beyond five 
percent during the ectinse of a contract, a review of the one 
tractor’s eligibility for continued access will be made. 

d. Types of Access: Within the APEX Security Control 


System there are various types of access in industry. These 


types of access are identified as: APEX GENERAL; APEX (Operationa 


with Phases I, Tl, and III; and APEX (Product). 

The security criteria for indoctrination are the 
same for all categories in that all must meet investigative 
requirements of this Manual and must satisfy strict need-to-know 


tests. 


Oe, *., 
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The extent of indoctrination for the various 


categories is as follows: 


APEX GENERAL - This category is intended 
for guards, protective, carat seracwe and 
other support personnel who need only to know | 
generally that a system such as APEX exists 
because their industrial firm has such contracts, | 
ena that it involves operational programs which_ 
generate product materials. Briefings of. APEX 


GEN approved individual will include reference 


_to US Government contractual contrcl but will ral 
not specify interested Departments ay aoeheies. | 
They will not be briefed on details of operational 
activity; will not be told the number of operational 
programs being conducted; will not be given the 
codeword names. They will be instructed in the 

rules for. protecting APEX material, fox its 

proper storage, transport and destruction, and 
28x its dissemination only to appropriately cleared 


individuals. 
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APEX ( ) - Phase I 
Operational Codeword 
This level of access is intended primarily for 
industrial contractorg personnel who resemble those’ 
in the APEX GEN category above (i.e., admin, protective, 
etc.). The criteria for access is identical yith the 
only exception being that the specific operational - 
‘program codeword will be divulged to the BHaee I approved 


person. This category is intended for those support <2 


type personnel who do not neet to know more than that 
a Syeeea such as APEX exists, that it must be protected, 
that National Security interests are involved and that 
the particular Project in which they and their firm 
participate has been given a specific code name. which 
they will be told. 
APEX ( } - Phase II 
Operational Codeword 

This level of access is intended also for edusesea 
contractors whose personnel need-to-know Howe about specific 
operational parameters than Phase I personnel but have no 


need-to-know all aspects of the Program. Included within 
ae 


eee as ey tl 
Curie NEAL 
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the Phase II briefing would be the general purpose 
of the Program, those technical details which are 


necessary to accomplish that portion of the engineering 


. design, development, fabrication or installation which 


is directly within the individual's area of assignment. 
Reference will not be made to the particular governmental 


sponsor unless its identity is obvious from the nature 


of the contract. This category of access should be 


considered for machinists, engineers not directly 


involved in total program planning and others not 


requiring full program knowledge. 

APEX ( ) - Phase III 

Be | Operational Codeword 

This eeyer of operational access is reserved for 

those in industry and ii guveramene who, bye virtue 
of contractual necessity or official duties, are 
required to have full knowledge of a particular 
operational Program. The Phase III level of access 
Will permit knowledge of all data released to the 


Phase I and II individuals plus it will allow detailed 


knowledge of the Program mission, sponsor, financial | * 
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arrangements, peographic operatonal bases, systen 
vulnerabilities, etc., as may be necessary. A 
need-to-know policy still exists despite approval 
for Phase III access and it should not be assumed 
that all details will be given to all Phase III 
accessed individuals. 
APEX ( . | ) - Generic Product 
The product resulting from operational Projects 
will be identified within the APEX Security Controi System 
by its generic term. Access to each of these generic’ *. 


products is not controlled by Phases of access. Most 
generally the APEX Product accesses will be reserved for 
analytic and research projects to produce finished 
intelligence. -There will also be requirements to 

grant this approval to personnel who must design 
certain processing equipment in support of intelligence 


production. 


Bye 
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VII. PHYSICAL SECURITY 


a. Construction and Protection Standards: All materials 
within the APEX Security Control System must be stored in 
accredited APEX areas. Standards for construction and pro- 
tection of facilities that store or process APEX material 
or provide discussion/work arcas for APEX information shall 
be as prescribed in the attached Physical Security Standards: 


for Sensitive Compartmented Information Facilities, dated 30S: 


April 1973 or other such guidelines as may subsequently super- 
eede 4t. (Appendix A) 

b. Accreditation of Facilities: Before an industrial 
facility is authorized to handle APEYpaterial, it must be 
accredited by the coanbe ant Government APEX Security Representa- 
tive as having met the aforementioned ecnecriceies and protection 
Svendapac. 

_ Inspections: Periodic inspections of approved APEX 
industrial facilities earner eae and must be accomplished 
at least annually. Inspections a to be sere dined by designated 


government APEX Security Representatives. who will be persons 


} 
experienced in conducting security inspections for the control 
ay 
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and storage of Sensitive Compartmented Information and will 
assure that procedures and safeguards comply with standards 
prescribed by this Manual. Reports of inspection will note 
all irregularities and will be forwarded to accrediting 
officials for review and necessary corrective action. In- 
spections will also include at least spot inventory of sensi- 
aie docuiients. Failure to incase any such documents will be 
reported on a priority basis. 

. d. Colocation within Facilities: when it is deemed 
economically desirable to colocate different APEX activities! : 
within a single industrial APEX facility, a determination maat 
first be made that such sharing will not have an adverse effect 
on either of the compartmented activities to be conducted. 

When security considerations permit, a "Memorandum of Agree- 
ment to Share Facilities” will be agreed to in writing by the 
industeial contractor and the government agencies sponsoring 
each separate APEX activity. The agreement will delineate the 
spaces to be used, storage procedures, access limitations, 
security responsibilities and any other provisions considered 


germane to sharing the facility. 


a 
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e. ee Destruction. and Evacuation Planning: Each 


APEX industrial facility must maintain an Emergency Plan which 
is approved by the cognizant Government APEX Security Rep- 
resentative. This plan will normally be part of an overall 
facility or corporate plan. It will, however, be separately 
Stated for the APEX facility and will include provisions for the 
" protectign of APEX data as well as protection of assigned 
personnel. Plans shel include provisions for the emergency 
destruction of sensitive materials as well as action to be % 
taken in the event of fire or other natural disaster. Emergency 
planning should ensure that adequate Pee and firefighting 
equipment is available, especially in vale areas, and that 
escape and emergency exit plans are provided for and published. 
Updates of Emergency Plans will be made annually and training 
‘provided to ‘familiarize assigned personnel with these plans. 

f. ‘Personnel Access Controls: “Positive controls for 
Were onnel access must be established over all areas where APEX 
information is handled. In areas where only small groups of 
personnel are involved, this control may be by means of personal 
identification. Where larger numbers, possibly beginning with © 


a figure of fifty, are involved, a system of identification badges 


# 
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\ 
may be required for assigned personnel and cleared yisitors. 


The industrial contractor will implement whichever procedure 
is deemed appropriate by the cognizant APEX Government Security 
Representative. Access to APEX areas by uncleared visitors 
must be approved in advance by sponsoring agencies except in 
those emergency situations where maintenance, fire or medical 
‘personnel may require access. Uncleared visitors will be 
escorted at all times while in APEX areas. 

g- Two Person Rule: To provide proper protection to 


APEX materials, SIO's, Government and Contractor Program * : 


On 


Managers will designate sensitive facilities, such as ACF's, as 
requiring "two man coverage" at all times. Persons selected to 
work in such areas will be chosen on the basis of fees 


reliability and | maturity. 


a 
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Villy. LECHNICAL SECURITY 


a. Technical Security Countermeasures: Technical Security 
Countermeasures inspections will be conducted as soon as possible 
after the opening of an APEY industrial facility and following 
major physical renovations. Reinspections are to be conducted 
every 18 months. Such iaaveceians will be scheduled by the 
cognizant Government APEX Security Representative’. The Governs 
ment APEX Security Representative will also ensure that 


ersonnel assigned to APEX facilities are briefed concerning ~ ~ 
S & 


the threat of technical penetration. 


Dy Computer Security: All Automatic Data Processing 
equipment used in APEX industrial facilities will be operated 
in complia:ce with standard requirements provided by the 
cognizant Government APEX Security Representative. No APEX 
or APEX-related information is to be processed prior to 
approval by the Government Security Representative. 

Cx Emanations Control (TEMPEST Security): -Prior to 
electrical processing of any APEX or APEX-related information 


»] 
equipment to be used must be certified as satisfactory from 


a 
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an emanations control seeapeiae sad that proper RED/BLACK 
enginecring measures have been taken to ensure that any con-.. 
promising emanations are contained within aréas determined 
to. be satisfactory. 

When new or modified equipments are brought into 
service in existing APEX areas, TEMPEST approval must be 
received. It is the responsibility of the cognizant Govern- 
ment APEX Security Representatives to arrange for all required 


TEMPEST inspections and schedule any required corrective 


measures. 


"NOTE: All requirements for technical security approvals 
are in addition to physical security approvals required in 


Section VIII. 
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IX. ACCESS APPROVAL CERTIFICATIONS 


a. General Guidelines: The cognizant Government APEX 
contracting or security representative is the sole authority 
empowered to certify APEX accesses held by a contractor to 
other government departments and Svenexes or to other govern- 
ment contractors or consultants. Such certification will be 
made only when "need-to-know" and the necessity of visit require- 
mone have been established. Normally, certifications will be 
made on a one-time visit basis only. However, in unusual cages, 
when constant contfact is required, term certifications for a peried 
not exceeding one year may be authorized. Visit certifications 
are to be made in writing, either by letter or securé communi - 
gation eincuies. as tequived by circumstances; when time does 
not permit, such certifications may be mode by telephone but 
should be confirmed subsequently in writing, 

b. Visits by Contractors: No visits will be undertaken 
by the contractor without the approval of the cognizant Govern- 
ment APEX program contract manager. oS v 

c. Central Access Approval Registry: To record and 
serve as the official central data base for the APEX Security 


Control System, a Central Access Approval Registry is established 
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as a service of Common concern, All éanprovals Within the 


APEX System will be on record in this data base. 

d. Information Updates: A critical feature of the APEX 
Security Control System is its ability to accurately reflect 
personnel currently éleared for various compartments of the 
System. To function properly, all contractors must provide 
timely information on changes in the status of their personnel. 
These updates will be provided to ensure that all briefing or 
debriefing actions are recorded as soon as possible. . 

The Central Access Approval Registry will proyirdes.. 
on a quarterly basis, lists of personnel approved on behalf ® | 
of individual contractors. It is expected that, with ee 
vision of these lists, review will be made of active approvals 
and that those no longer needing access will be cancelled and 
reported through cognizant agencies to the Central Registry. 
This is a continuing requirement. assigned to each ACO irrespec- 
tive of the formal annual review by Program Managers of personnel 
approved for access. | 

These same listings will be used to correct records 
in order to reflect personnel approved but not recorded in 


the Central Registry. Verification, through Program Managers: 


ho: 
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Will be effected, as necessary, prior to adding personnel 
or approvals for already approved personnel to the Central 


Registry. 


wa 
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X. SECURITY CLASSIFICATION AND CONTROL GUIDELINES 
a. Basic Guidance: Security classification and document 
control are a function of Management. Classification of infor- 
mation, therefore, will be accomplished only by individuals 
‘specifically authorized under E.O. 12065. This authority 
extends to contractors through Government contracting officers. 
Use of compartmentation caveats will be solely to provide 


need-to-know or access protection where normal management and 
safeguarding procedures are not, as a protectivé measure, con= 
sidered sufficient. Using compartmentation as a means of | 
restricting access to Sensitive eats should be viewed as a 
meaningful exercise and not one which occurs by force of habit. 
b. Decompartmentation/Sanitization: Contractors are not 
authorized to decompartment or sanitize any materials (documents, 
filn, hardware, tape, et al) except as specifically approved 
by cognizant agencies. Authority to decompartment or sanitize 
must be received in writing and must be kept with program. records 


for the duration of the contract. Secure electrically trans- 


mitted messages may function as the required written authority. 


Com petal 
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Restrictions: Any person with access to APEX may challenge 
either the classification level or the necd for compartnented 
control of any APEX material. The challenger should submit 
the challenge to the originating component for consideration. 
Items which are irreconcilable shall be forwarded through 


APEX control channels for final review and resolution. 
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XI. CONTROL STANDARDS AND PROCEDURES 


a. Classification Levels: Documents in the APEX Security 
Control System will be classified according to damage accruing 
to National Security if. disclosed without authority. Classifica- 
“tion levels will be ascribed in accordance with E.0. 12065, 
-Teserving CONFIDENTIAL for "identifiable damage", SECRET for 
“serious damage"', and TOP SECRET for "exceptionally grave a 
damage". No’other classification levels are authorized and, 52 
none are to be adopted within the APEX Security Control System. 

b. Classification Guides: Contractors will be furnished 
Classification Guides by Government Program Managers or contracting 
officers to assist in the classification of documents, hardware 
or other items Sei sinetane in Contractor firms. These guides 
will be made as‘specific as possible and will be used as the 
_ means by which contractor firms assign classificetion categories. 
Cognizant Government agencies will provide individual guidance 
as required for situations not covered in the basic guides. | 

c. Labelling: The following labelling: requirements are 
established for all written or graphic materials that contain 
APEX information and are disseminated within the APEX DER EEeY 
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Iu Grasse tne aon: The overall classification 

of a document, whether or not permanently bound, 

or any copy or reproduction thereof, shall be con- 
_Spicuously. marked or Stamped at the top and bottom 
of the outside of the front cover (fi! any), on the 
title page (if any), on the first page, on the 
back page, and on the outside of the back cover 

(ee cay). Each interior page of a document shall 
be ecaspicuonsiy marked or stamped at the top and 


4 


bottom with the highest classification of the document: . 


The determination of national security classification: 
shall be on the basis of the policies indicated in 
Executive Order 12065 on Nations Security Infor- 
mation. Portions of documents, to include paragraphs, 

- subparagraphs, and titles shall be marked to reflect 
the evel-ofuctassiFieat ion and dissemination con- 
trol maranye or that the particular portion is 


unclassified. 


2. Control system Caveats: All documents 


controlled within the system will be marked "HANDLE 


VIA APEX SECURITY CONTROL SYSTEM" on the front 
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cover (if ss title page (if any), back 
page and first page of all documents... Each 
interior page which contains APEX information 
will also bear the same markings. 

3. Codewords and Indicators: Codewords 
for operational projects and product indicators 
will be placed following the classification 


marking on the top and bottom of the title 


page, first page and each page which contains 


information requiring specific codeword/indicator 
protection. 
4. Control Numbering: APEX document control 


numbers,which will be provided by cognizant govern- 
ment agencies, will be placed immediately above 
the Control System Caveat on the front cover, title 
page and first page of each document. A "one up" 
six digit numbering system, to include year of 
creation, will be utilized (e.g., A-123456/79). 

5. Declassification Review Notice: Having 
satisfied threshold criteria demanding protection 


under the APEX Security Control System due to 


sensitivity of the source, method or the infor- 
mation itsclf, APEX materials are classified for 


a period of 20 years excepting Foreign Government 


4S 
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Information which will remain protected for 38 
years. The following Declassification Review 
Notice will be used on the cover, title page, 
or first page of typescript text, or inside 
of formal publications: | 
Classified By: (appropriate authority) 
Review for Declassification On: (Indicate 
date, 20 or 30 years from date of issuance) 
Reason for Extended Classification: APEX.XII.B.6 
The abbreviation "REVW 20/30 YRS" may be sub- 
Stituted in electrically transmitted messages, 


6. Abbreviations: Distinctive APEX markings will 


not be abbreviated where there is a likelikood that the. 


abbreviation will be confusing or otherwise not under - 
“stood by the recipient. A standard list of approved 
abbreviations will be provided to contractors. 


7. Marking Bales, Folders or Groups of Documents: 


Files, folders, or groups of documents shall be con- 
BETA, 
spicuously marked to assure the protection of all Sct 
contained therein. Such material shall be marked on 
the file folder tab or other prominent location or 
REF X 
affixed to an appropriate £6 cover sheet. 
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material to be transmitted from one facility to another must 


be carried either by two couriers approved for this purpose, 

by diplomatic pouch, or by the Armed Forces Courier Service 
(ARECOS). Courier procedures shall ensure that APEX materials 
are adequately protected against the possibility of hijacking, 
-unauthorized viewing, loss or other form of compromise ducing 
the Grawenies ton: Transmittal of APEX material via non-U.S. | 
Government operated or chartered aircraft is prohibited. * The 


cognizant SIO must specifically approve all exceptions. ae 


Pe 


APEX couriers shall be active duty military or U.Si! 
Government civilian employees meeting investigative standards 


of this Manual and be specifically designated by the cognizant 


sponsoring agency. Couriering of APEX by contractor employees — 
is prohibited except when specifically approved by a responsible | 
government official. , 


, APEX siateriais shall be enclosed for delivery in two 
opaque envelopes or otherwise be suitably double-wrapped using 
canvas bags, cartons, crates, leather pouches, etc. Containers 
will be secured with tape, lead seals, tumbler padlocks, or by 
other means which would reasonably protect against surreptitious 


access. 


Does not apply to ARFCOS and the Diplomatic Courier Service 
vavivam mann - 
CONFIDENTIAL. 
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The inner and outer container shall be annotated te 
Show the pouch address and peekids number of the Sending APE: 
facility. The notation "TO BE OPENED BY THE ACO" shall be 
placed above the pouch address of the receiving APEX facility 
on both containers. ‘The proper security classification and 
caveat "CONTAINS APEX CONTROLLED MATERIAL" shall be annotated 


on each side of the inner wrapper only. The inner container 
shall contain the document receipt and should also reflect the 


name or office symbol of the person/activitiy for whom the | 


material is intended ore 


d. Electrical Transmissions: APEX material transinitted: 
electronically will be controlled according to procedures pre- 
scribed below. Senders must assure that electronic transmissio 
are made only to authorized recipients and receivers must provi 
procedures for the proper protection.of APEX material received | 
in ‘this manner. These procedures shall include the establish- 
ment of a recipient's need-to-know in circumstances where no 
hard copy or record copy of the material will result. 

The transmission of APEX material shall be restricted 
to means specifically approved and accredited for this purpose, 

Electrical cpavemise tou of APEX material shall be 
limited to specifically accredited communications circuits 
secured by a government approved crypto end protected distri- 


bution system. 
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Operational procedures saH11 ensure that only properly 
indoctrinated personnel are provided access to clear text APEX 
materials. 

| Material transmitted by accredited communications 
circuits or other specialized means shall be marked at the top 
and bottom with the assigned classification and paragieph marked 
in the manner prescribed above for documents. Applicable code- 
words, destanatevs; caveats, etc., shall be clearly shown con- 


Sistent with the design of the message form or format being 


used, | . : ae 
The first item in the text of a message shall be the. - 

overall classification of the message, applicable codeword(s), 
Control System Designator, and’ such other markings as may be 
required to note dissemination controls. 

oe Cover Sheets: To preclude unauthorized disclosure, 
an unclassified cover sheet shall be used when transmitting 
APEX materials outside an ACF. Publications need not have 
a separate document cover sheet setiwsd if the publication 
‘cover includes all prescribed markings and is unclassified 
standing alone. 


f. Destruction: As soon as possible after its purpose 


has been served,,all APEX controlled material shall be destroyed 


in a manner that will preclude reconstruction in any intelligible 


“eo 
CONTIDENTIAL 
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form. However, only those items approved by the cegnizant 
y Ppp Y g 

government agency may be destroyed, and only those methods 

of destruction specifically authorized by the responsible 


government program manager shall be used. (These methads nay 


25X1 


destroyed). All destruction shall be supervised and witnessed 
by at least two APEX indoctrinated individuals. Destruction 
certificates will be completed for all items destroyed. APEX 
material contained within computer or automated data processing 
Systems or other magnetic media shall be erased by epueevea : 
degaussing equipment or destroyed by other approved means. 

g. Repeeducedion=  Reswoauetten of APEX material shall be 
kept to a minimum consistent with operational necessity. Copies 
of aAdedansaes are subject to the same contrcls ae the original. 
Adherence to stated prohibitions against reproduction is manda- 
tory. <Any enuienens used for APEX reproduction must be thoroughly 
inspected and sanitized before removal from an APEX facility. 

Reproduction of TOP SECRET materials wetnee the APEX 
System requires consent of originating Agencies. Materials 


classified SECRET or CONFIDENTIAL may be restricted from re- 


production by originating Agencies. 


oy 
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h. Accountability: All APEX TOP SECRET documents will 
be inventoried at least annually or when there is a termination 
of contract, a change of designated APEX Control Officers or 
authorized custodians of such material. | 

- Random inventories will be conducted annually for 
all APEX materials classified SECRET or CONFIDENTIAL according 
_to formulacprovided by the cognizant government Agency ASO. 
Should the random inventory of APEX material fail to 


‘locate a number of the sampled documents, the contractor ASO 


will order a complete inventory of all APEX documents received 


ee ae 


by an APEX Control Facility. : aa 

' Reports of discrepancies will be provided to the “ 
cognizant agency who will initiate a search for and investigation 
of all neue documents. _ - 

APEX Control Facilities shall keep 4 record of all APEX 
_Numbered materials that are received by or dispatched outside the 
Control Facilities. This dissemination record shall include a- 

a , 
brief entry which identifies the nature of the controlled material 
and the specific organizations - outside or within the Control 
Facility - for whom the material is intended. Bissensnaeion 
records of incoming materials shall be retained. The dissemination 


record requirement for dispatched materials'may be satisfied by 


pees 
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Keeping copies of the envelop’ package/pouch receipt or 
other appropriate dissemination record maintained by the 
dispatching Control Facility. Such receipts ehourd be 
retained for a minimum of two years. 

Working materials containing APEX-controlled data, 
that are used and retained exclusively within an ACF - such 
as preliminary drafts of reports, studies, film clips included 
in analysts’ reference files, and waste materials such as 
carbon sheets, carbon ribbons, reproduction plates, stencils, 
composition tapes, masters, stenographic notes, work sheets ,-. 
and similar items - do not require an APEX number or dissemination 
record but shall be safeguarded and marked as "WORKING PAPERS” 
in accordance with the storage’ requirements for APEX-controlled 


materials. 


co 
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ALLS PROCEDURES FOR CONTROL OF OTHER HARD COPY NOCUMENTS 

ae Automatic Data Processing: All automatic data 
processing of APEX controlled information and material will 
be conducted in accordance with instructions provided by the 
responsible Government official. To facilitate identification, 
accounting ene control of APEX- controlled data in magnetic form, 
each reel or cassette o£ tape, each magnetic. card or disk pack | 


which contains APEX-controlled data will be prominently marked 


vt 


with labels indicating security classification, APEX Security , 
Control System markings and other required APEX caveat designators 
Internal media identification must include a header and trailer 
block which contains security markings. 
b. _Film/Photographic Materials: Roll film, sitise. or 
other forms of photographic negatives or positive items must 
be labelled as to security classification and control. wader 
APEX control procedures and document and copy number. 
| Labels on roll film placed in metal containers will 
be located as follows: 
1. one on end of spool flange 
2. one on side of spool container, and 


*3. one on container cover. 
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Vo 
Film bh tans parent containers needs only one label 
placed visibly on the spool flange. This procedure is eee 
to facilitate reuse of the containers. 

C. Microfiche: Each microfiche will have a hiade patasd 
elements are readable without magnification. The heading 
elements will specify: the long and short titles of the 
document; security classification and codewords which shall 
not be abbreviated; standard abbreviations or codes for handling 
caveats, dissemination control markings and distribution re~ 
Strictions. The exact PEagemeat of the heading elements wild « 
be as prescribed by the responsible government official. von 
fiche may also be placed in envelopes which, through a specified 
color code, Sndcaee the level of security protection to be 

accorded the microfiche. 

d. Microfilm: Each roll of nicrofiin, whether mounted on 
an open reel or.in a Cartridge, will contain security informa- 
tion which is readable without magnification. For source 
document microfilm, the information Will be on a page target and 
contain the security classification and codewords,-which shall - 
not be abbreviated, standard abbreviations and codes for handling 


caveats, dissemination control markings and distribution 


ae. 
5 
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restrictions. This page target will immediately precede 
the first page of the document. and will follow the last 


page of text preceding the "END - date filmed" target frame. 


For film produced by a Computer Output Microfilm (COM) recorder, 


the above mentioned security information will be recorded in 
human readable format when within equipment capability on a 
length of.film immediately preceding and following the document 


text. The boxes containing processed film in onet reels: and 


the film cartridges will be labeled with the appropriate Sceuryey 


information. In addition, the labeling will include the docu-. 
ment's long and short titles. Microfilms containing documents 
with individual titles and APEX numbers too numerous to be 
included on the label, may be identified by a generalized 


composite title and a new APEX number. 
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XIII. SECURITY VIOLATIONS / CON PROMISES 


‘a. Responsibility to Report: Each person approved and 
briefed for APEX access is responsible for reporting any possible 


security violations or compromises of APEX information to his/ 


‘her APEX Security Officer. Such reporting must be done immediately 


to keep damage to an absolute minimum. Adinvestigation is to 

be conducted Pnediatery if there is a probability that a 

compromise has occurred. The cognizant government agency ASO. 

is to be notified both of the incident and investigative ae 

in. timely fashion. | | | 
b. Investigative necsensinintey: Contractor and cognizant 

government: Agency ASO's are jointly responsible for the investi- 

gation of all security violations and possible compromises of 

. APEX materials within their jurisdiction. jiieev es csens will 

attempt to develop full details of the violation or compromise, 

determine whether and how much information was exposed, what 

acnawe vesubteds and offer conclusions as to whether culpability 

was apparent in allowing the violation or compromise to occur. 


Penalties will be assessed as prescribed by the cognizant 


- 


government Program Managers. These veolers ens will be administerec 


wey: 


SG 
rOMEIDENTIAL 
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by the ASO and punitive action taken will be recorded in 


contractor and cognizant government agency security files. 


When it is determined that material has, in Pe 2 
_been revealed improperly or accidentally to an unauthorized 
U.S. national, the contractor will-immediately advise the 

- cognizant, Government ASO of the incident and will secure an 
agreement of secrecy on the inadvertent exposure. 

If the inadvertent exposure has been made to a non:U.S. 
citizen, the contrictor ASO will obtain guidance from the cognizan 
Government agency ASO whether or not to seek an inadvertent 
disclosure statement. _ | 

In all cases of inadvertent exposure a written report will 
be provided by the contractor ASO to the cognizant agency ASO. 

If personnel to whom inadvertent exposure has been 
made have been investigated to DCID 1/14 standards, have 
executed an inadvertent exposure oath and can reasonably be 
expected to honor their obligation to maintain APEX security, 
the cognizant Government ASO may make a finding that no | 


compromise has occurred. 
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c. Corrective Action: In the course of investigatin 


92 


security violations and compromises, it may become clear that 
there are weaknesses in operating procedures in the affected 
components. It is the responsibility of each contractor ASO 
“when identifying such basic flaws, to initiate corrective 
action. The corrective action recommended will be incorporated 
in the investigative report to the cognizant Government Agency 


ASO. 
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XIV. SECURTTY EDUCATION 


Security education is a continuing program which must 
be formally provided at the time of initial indoctrination, 


periodically while in approved status and at the time of 
termination of access. At all times toth ASO's and all 
indoctrinated personnel niise. Convinua lay maintain and increase 
security awareness on the part of all approved individuals 


through day-to-day vigilance and reinforcement of basic 


wy eat 
ays A ei 
id 4h 0e 


security principles. 


oy 


a. Initial Indoctrination: Upon the granting of initial’ 
access, personnel are to be indoctrinated by an ASO. The _ 
indoctrination will, at a minimum, include the following: 

1. The need for , purpose,and structure, of 

' the APEX Security Control System and the adverse 
‘effects on the national security that could result 
from unauthorized disclosure of APEX information. 

2. An explanation of the sensitivity of APEX 
information and its velatonsnap to other intelli- 
gence information processed by the United States 
Governnent. 

sg, The administrative, physical and other 
procedural aceuntiy requirements of the. APEX Security 


Control System. 


ETERS light 
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4. Individual classification management 
responsibilities of personnel in the APEX system 
to include classification/declassification, de- 
compen encarta tion and sanitization Buecolnes 
and marking requirements. 

5. The criminal penalties for espionage and 
unauthorized disclosure in the appropriate sections | 
of Titles 18 (e.g., Sections 792-798) and 50, U.S. 
Code, relative to APEX information. 


6. The administrative sanctions $e violation 


yg et 
sed t 
¥ 


or disrepard of APEX secuneGy preecdum eee: 

7. <A review of the techniques employed by 
foreign intelligence organizations in attempting 
to obtain national security information. 

8. A review of individual security responsi- 
bilities to include, at a minimun, 

(a) the prohibition against disclosing 
any Classified information over either non- 
secure telephones or in non-secure places, 

(b) the nced and method to determine 
that prospective recipients are approved for 
access, truly need information to perform 
‘their official duties and can provide proper 


protection to the information in question, 
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‘(c) administrative reporting require- 
ments such as non-official foreign travel, 

E . | contacts with foreign nationals, attempts by 
unauthorized persons to obtain APEX informa- 
tion, possible loss or compromise of APEX 
material, physical security deficiencies or 
probable personnel security concerns which 
would impact adversely on APEX security. 


b. Periodic Reindoctrination: At intervals of no less 


7 
~ 
a 


than two years; all APEXwindoctrinated personnel are to receive 
a formal reindoctrination. This reindoctrination should cover 
all the points enumerated in paveuvenns. In addition, as 
personnel grow in understanding ha ee APEX Security Control. 
fp ‘ 

| System by Deine exposed to icy’ should? develop" themes on a more 
sophisticated Tevel appropriate to the specific types of APEX 

| activity involved (e.g., voinevabataty of operational activities. 
#6 countermeasines. need to protect identity of human sources 
for purposes of their individual safety, etc.}. Such reindoc- 
trinations should reinforce responsibilities of the individual 
and this opportunity should be used eo ueneouraue’ suneeset one for | 


better security within the system. 
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c. Termination of Access: When it has been cetermined 


that individual no longer require access to any type of AP 


ret 


information, they should be scheduled for a debriefing and 
provided: wien final instructions and guidelines on the 
protection of APEX. information and their personal responsi- 
bilities. At a minimum, this debriefing will snenuaes 
a 1. A reminder of the appropriate sections 
of Titles 18 and 50 of the U.S. Code, their pro- 
visions and criminal sanctions relative to espionage _ 


and unauthorized disclosure. 


at lea 


2. The continuing obligation never to 
divulge, publish or otherwise reveal to any 
unauthorized person any APEX sneornaeron without 

express permission of the appropriate responsible’ 
6Fficials: 

3. An acknowledgement oi individual 
responsibility to report to appropriate U.S. 
Government officials any attempt by an un- 
authorized person to solicit APEX information. 

4. A declaration that the individual no. 
longer has any APEX materials in his/her possession. 

5. A neve of travel restrictions and 
reporting requirements, if required. . + 
At. the time Ge Gobe vem: the person terminating should 

again be encouraged to provide any comments pertinent to 


enhanced APEX security. 
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